Aspects of the present invention relate generally to the field of network security, and more particularly to the exchange of keys between stations in a wireless network.
In wireless local area networks (LANs), link layer security protocols may be based on the IEEE 802.11 specifications. Early security models such as Wired Equivalent Privacy (WEP), Temporal Key Integrity Protocol (TKIP) and Wi-Fi Protected Access (WPA) that were typically used to protect data sent between stations in a wireless network have been replaced with WPA2. The WPA2 protocol uses an Advanced Encryption Standard (AES) cipher with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). WPA2 uses a four-way handshake to exchange unique nonce (number used once) pairs and establish a unique pairwise key for each pair of communicating stations.
A wireless LAN may utilize a variety of architectures. For example, a wireless LAN can be organized in a star topology with a central access point station communicating with several client stations. Each client station communicates directly only with the access point. Stations can be connected to a network via a network adapter or network interface card that manages the network communications and can provide a MAC address for the station. Alternatively, a wireless LAN can be organized with a basic service set (BSS). In a BSS topology, all the client stations communicate directly with each other. An independent BSS allows communication without use of an access point. Peer-to-peer networks or ad-hoc networks may be independent BSS networks. An infrastructure BSS allows communication between client stations on the BSS network and client stations not on the BSS network via an access point.
Independent Basic Service Set (IBSS) networks, mesh networks, and direct link setup networks in accordance with the IEEE 802.11z standard, may each use a WPA2 protocol to protect inter-station communications. The WPA2 security protocol used in an IBSS may be complicated by the need for unique key/nonce pairs for each pair of communicating stations. A smesh network is an 802.11 multi-hop wireless network that uses a fast handoff scheme to enable client devices to roam in the network within interruption in connectivity. In such systems, where there may not be a central access point responsible for managing communication and security among the nodes of the network, secure communication requires that each station exchange a pair of keys with every other station with which the station communicates.